{ "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.github.Sushegaad/iso27001-mcp", "description": "ISO 27001 compliance workspace for Claude. Risks, policies, SoA, evidence, and audit workflows.", "repository": { "url": "https://github.com/Sushegaad/MCP-Server-for-ISO27001", "source": "github" }, "version": "0.9.82", "packages": [ { "registryType": "npm", "identifier": "iso27001-mcp", "version": "0.9.82", "transport": { "type": "stdio" }, "environmentVariables": [ { "name": "DB_ENCRYPTION_KEY", "description": "32-byte hex key for AES-256 SQLite encryption (generated by iso27001-mcp init)", "isRequired": true, "isSecret": true, "format": "string" }, { "name": "HMAC_SECRET", "description": "32-byte hex secret for HMAC-signing API keys (generated by iso27001-mcp init)", "isRequired": true, "isSecret": true, "format": "string" }, { "name": "MCP_API_KEY", "description": "API key for authenticating tool calls (generated by iso27001-mcp keygen)", "isRequired": true, "isSecret": true, "format": "string" }, { "name": "DB_PATH", "description": "Path to the encrypted SQLite database file", "isRequired": false, "isSecret": false, "format": "string" } ] } ], "updatedAt": "2026-09-01T01:14:02.556Z", "toolCount": 56, "tools": [ { "name": "list_controls", "description": "List ISO 27001 controls with optional filters: version, theme, control_type, new_in_2022, cybersecurity_concept, and pagination.", "minRole": "viewer", "annotations": { "readOnlyHint": true } }, { "name": "search_controls", "description": "Full-text search across control names, descriptions, and guidance using the FTS5 index.", "minRole": "viewer", "annotations": { "readOnlyHint": true } }, { "name": "get_control_attributes", "description": "Retrieve the 2022 attribute tags for a control: information_security_properties, cybersecurity_concepts, operational_capabilities, security_domains.", "minRole": "viewer", "annotations": { "readOnlyHint": true } }, { "name": "compare_versions", "description": "Show the mapping relationship between a 2013 control and its 2022 equivalent(s), or vice versa.", "minRole": "viewer", "annotations": { "readOnlyHint": true } }, { "name": "list_clause_requirements", "description": "List ISO 27001:2022 clause requirements (clauses 4–10), optionally filtered by parent clause.", "minRole": "viewer", "annotations": { "readOnlyHint": true } }, { "name": "create_gap_assessment", "description": "Create a new gap assessment against ISO 27001:2022 or 2013 controls for a defined ISMS scope.", "minRole": "analyst", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "update_control_status", "description": "Set the implementation status of a control within a gap assessment (implemented, partial, not_implemented, na, not_started). Omit confirmed or pass confirmed=false to preview changes without writing; pass confirmed=true to commit.", "minRole": "analyst", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "list_gap_assessments", "description": "List gap assessments filtered by status (active, archived, all).", "minRole": "viewer", "annotations": { "readOnlyHint": true } }, { "name": "export_gap_report", "description": "Export a full gap assessment report in markdown, CSV, or JSON format.", "minRole": "viewer", "annotations": { "readOnlyHint": true } }, { "name": "generate_remediation_roadmap", "description": "Generate a prioritised remediation roadmap from a gap assessment, grouped by risk level and theme.", "minRole": "viewer", "annotations": { "readOnlyHint": true } }, { "name": "archive_gap_assessment", "description": "Archive a completed or superseded gap assessment with an optional reason.", "minRole": "analyst", "annotations": { "readOnlyHint": false, "destructiveHint": true } }, { "name": "create_risk", "description": "Register a new information security risk with asset, threat, vulnerability, likelihood (1–5), and impact (1–5).", "minRole": "analyst", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "update_risk", "description": "Update mutable fields of an existing risk (asset, threat, vulnerability, likelihood, impact, owner, status, related_controls). Omit confirmed or pass confirmed=false to preview a field-level diff without writing; pass confirmed=true to commit.", "minRole": "analyst", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "list_risks", "description": "List risks with optional filters: risk_level, status, owner, and pagination.", "minRole": "viewer", "annotations": { "readOnlyHint": true } }, { "name": "create_treatment_plan", "description": "Create a risk treatment plan (mitigate, accept, avoid, or transfer) with owner, due date, and optionally residual risk scores.", "minRole": "analyst", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "update_treatment_status", "description": "Update the status and evidence reference for an existing risk treatment plan. Omit confirmed or pass confirmed=false to preview changes without writing; pass confirmed=true to commit.", "minRole": "analyst", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "generate_risk_register", "description": "Export the full risk register in markdown, CSV, or JSON format with optional level/status filters.", "minRole": "viewer", "annotations": { "readOnlyHint": true } }, { "name": "create_policy", "description": "Generate a new ISMS policy document from a Mustache template using organisation_name, scope, owner, and effective_date. Omit confirmed or pass confirmed=false to preview what will be created without writing; pass confirmed=true to generate and save the policy.", "minRole": "analyst", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "update_policy", "description": "Create a new version of an existing policy with scope/owner changes, reviewed_by, and change_summary. Requires admin role. Omit confirmed or pass confirmed=false to preview the version bump and metadata diff without writing; pass confirmed=true to commit.", "minRole": "admin", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "list_policies", "description": "List policies with optional filters: status, type, owner, overdue_only, and pagination.", "minRole": "viewer", "annotations": { "readOnlyHint": true } }, { "name": "generate_soa", "description": "Generate a Statement of Applicability from a gap assessment, pre-populating inclusion/exclusion for all controls.", "minRole": "analyst", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "update_soa_entry", "description": "Update an SoA entry's inclusion status, justification, implementation status, and responsible party. Omit confirmed or pass confirmed=false to preview changes without writing; pass confirmed=true to commit.", "minRole": "analyst", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "export_soa", "description": "Export the Statement of Applicability in markdown or CSV format.", "minRole": "viewer", "annotations": { "readOnlyHint": true } }, { "name": "create_audit", "description": "Create an internal ISMS audit record with auditor, planned date, and controls/clauses in scope. Omit confirmed or pass confirmed=false to preview the audit record without writing; pass confirmed=true to commit.", "minRole": "admin", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "record_finding", "description": "Record an audit finding (NC, observation, or OFI) against a clause or control. Omit confirmed or pass confirmed=false to preview the finding without writing; pass confirmed=true to commit.", "minRole": "admin", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "create_corrective_action", "description": "Create a corrective action request (CAR) linked to an audit finding with owner and due date. Omit confirmed or pass confirmed=false to preview the CAR without writing; pass confirmed=true to commit.", "minRole": "admin", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "update_corrective_action", "description": "Update a corrective action's status, root cause, evidence reference, or effectiveness verification.", "minRole": "admin", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "generate_audit_report", "description": "Export an audit report including findings and CAR status in markdown or JSON format.", "minRole": "viewer", "annotations": { "readOnlyHint": true } }, { "name": "register_evidence", "description": "Register an evidence artefact linked to a control with type, source URL, collector, and optional expiry date. Omit confirmed or pass confirmed=false to preview the evidence record without writing; pass confirmed=true to commit.", "minRole": "analyst", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "list_evidence", "description": "List evidence records for a control, optionally filtered by status (current, stale, expired).", "minRole": "viewer", "annotations": { "readOnlyHint": true } }, { "name": "verify_evidence", "description": "Record an independent verification of an evidence artefact: reviewer (must differ from the collector), verification_status (verified | rejected), sufficiency (required when verified), and an optional assertion. Omit confirmed or pass confirmed=false to preview without writing; pass confirmed=true to commit.", "minRole": "analyst", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "link_jira_ticket", "description": "Link an evidence record to an existing Jira ticket by key, or create a new ticket from a summary.", "minRole": "analyst", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "link_github_issue", "description": "Link an evidence record to an existing GitHub issue by number, or create a new issue from a title and body.", "minRole": "analyst", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "query_audit_log", "description": "Query the tamper-evident audit log with optional filters: date range, tool, outcome, role, key_hash, actor_type (ai | human | system).", "minRole": "admin", "annotations": { "readOnlyHint": true } }, { "name": "list_api_keys", "description": "List all API keys with their metadata (label, role, status, expiry). Never returns key hashes.", "minRole": "admin", "annotations": { "readOnlyHint": true } }, { "name": "revoke_api_key", "description": "Revoke an API key by label, preventing all future use.", "minRole": "admin", "annotations": { "readOnlyHint": false, "destructiveHint": true } }, { "name": "set_organization_profile", "description": "Upsert the singleton organization profile (legal name, jurisdiction, ISMS scope, RACI roles). Used by create_policy and create_procedure to auto-inject org defaults.", "minRole": "admin", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true } }, { "name": "create_procedure", "description": "Generate a new ISMS procedure document from a Mustache template. Optionally links to a parent policy. Falls back to org profile for organisation_name and scope if not supplied.", "minRole": "analyst", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "update_procedure", "description": "Archive the current procedure version and re-render with updated fields, incrementing the version number. Requires admin role. Omit confirmed or pass confirmed=false to preview the version bump and metadata diff without writing; pass confirmed=true to commit.", "minRole": "admin", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "list_procedures", "description": "List procedures with optional filters: procedure_type, status, policy_id, overdue_only, and pagination.", "minRole": "viewer", "annotations": { "readOnlyHint": true } }, { "name": "export_procedure", "description": "Export a procedure as a markdown document (with related controls appended) or as structured JSON.", "minRole": "analyst", "annotations": { "readOnlyHint": true } }, { "name": "create_management_review", "description": "Schedule a new management review (ISO 27001:2022 Clause 9.3) with title, date, and reviewers list.", "minRole": "admin", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "record_review_input", "description": "Record one of the 7 mandatory Clause 9.3.2 input categories for a management review. Upserts on re-submission; advances status to in_progress on first input.", "minRole": "admin", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true } }, { "name": "record_review_output", "description": "Record a Clause 9.3.3 output decision (improvement_decision or isms_change_decision) for a management review.", "minRole": "admin", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "complete_management_review", "description": "Mark a management review as completed. Enforces ISO 27001:2022 §9.3.2: all 7 input categories must be recorded, and at least one output must be present. Omit confirmed or pass confirmed=false to preview review readiness (inputs recorded vs. missing, output count) without writing; pass confirmed=true to finalise.", "minRole": "admin", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "list_management_reviews", "description": "List management reviews with optional status filter and pagination.", "minRole": "viewer", "annotations": { "readOnlyHint": true } }, { "name": "create_improvement_opportunity", "description": "Register a proactive improvement opportunity (ISO 27001:2022 Clause 10.1) with source, priority, owner, and optional target date. Not linked to a nonconformity.", "minRole": "analyst", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "update_improvement_opportunity", "description": "Advance an improvement opportunity's status (forward-only: open → in_progress → implemented → closed) or update owner, target date, priority, or description.", "minRole": "analyst", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "list_improvement_opportunities", "description": "List improvement opportunities with optional filters (status, source, priority, review_id) and a backlog health rating (excellent/good/fair/needs_attention/at_risk).", "minRole": "viewer", "annotations": { "readOnlyHint": true } }, { "name": "generate_evidence_document", "description": "Render one of 6 Mustache evidence templates (access_review_attestation, training_acknowledgement, supplier_security_questionnaire, incident_post_mortem, bcp_test_report, risk_treatment_sign_off) with org-profile auto-injection. Returns rendered Markdown and simultaneously registers an evidence record.", "minRole": "analyst", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "list_evidence_documents", "description": "List generated evidence documents with optional filters: template_type, generated_by, control_id, and pagination.", "minRole": "viewer", "annotations": { "readOnlyHint": true } }, { "name": "import_risks", "description": "Bulk-import risks from a CSV string. Supports dry_run=true for validation preview. Headers: asset, threat, vulnerability, likelihood (1–5), impact (1–5), owner, status, related_controls (semicolon-separated).", "minRole": "analyst", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "import_control_statuses", "description": "Bulk-update control implementation statuses in a gap assessment from a CSV string. Supports dry_run=true for validation preview. Headers: control_id, status, notes, na_justification.", "minRole": "analyst", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "set_risk_methodology", "description": "Upsert the organisation's singleton risk methodology: likelihood/impact scales, calculation method, risk level bands, acceptance threshold, escalation rules, and review frequency. Omit confirmed or pass confirmed=false to preview the diff against the current methodology without writing; pass confirmed=true to commit.", "minRole": "admin", "annotations": { "readOnlyHint": false, "destructiveHint": false, "idempotentHint": true } }, { "name": "record_risk_acceptance", "description": "Record a risk owner's decision to accept or reject residual risk (ISO 27001:2022 §6.1.3), freezing inherent/residual scores and the acceptance threshold at decision time. Requires residual scores on the treatment plan when one is referenced; accepting an above-threshold residual demands a substantive rationale. Omit confirmed or pass confirmed=false to preview; pass confirmed=true to commit.", "minRole": "analyst", "annotations": { "readOnlyHint": false, "destructiveHint": false } }, { "name": "list_risk_acceptances", "description": "List recorded risk acceptance decisions with optional filters (risk_id, decision) and pagination.", "minRole": "viewer", "annotations": { "readOnlyHint": true } } ] }